CVE-2023-29800

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version V9.1.0cu.2024 B20220329

Description The issue is related to insufficient argument validation in the UploadFirmwareFile function of the TOTOLINK X18 router's firmware, allowing a remote attacker to execute arbitrary commands using the FileName parameter.

Recommendations For TOTOLINK X18 version V9.1.0cu.2024 B20220329, as a temporary workaround, consider restricting access to the UploadFirmwareFile function until a patch is available. Avoid using the FileName parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.